summaryrefslogtreecommitdiff
path: root/core/krb5/krb5-1.9.1-2011-006.patch
blob: 05a22caf53e1aea8f22f52bedb8743b2b72af635 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
diff --git a/src/plugins/kdb/db2/lockout.c b/src/plugins/kdb/db2/lockout.c
index b473611..50c60b7 100644
--- a/src/plugins/kdb/db2/lockout.c
+++ b/src/plugins/kdb/db2/lockout.c
@@ -169,6 +169,9 @@ krb5_db2_lockout_audit(krb5_context context,
         return 0;
     }
 
+    if (entry == NULL)
+        return 0;
+
     if (!db_ctx->disable_lockout) {
         code = lookup_lockout_policy(context, entry, &max_fail,
                                      &failcnt_interval, &lockout_duration);
@@ -176,6 +179,15 @@ krb5_db2_lockout_audit(krb5_context context,
             return code;
     }
 
+    /*
+     * Don't continue to modify the DB for an already locked account.
+     * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and
+     * this check is unneeded, but in rare cases, we can fail with an
+     * integrity error or preauth failure before a policy check.)
+     */
+    if (locked_check_p(context, stamp, max_fail, lockout_duration, entry))
+        return 0;
+
     /* Only mark the authentication as successful if the entry
      * required preauthentication, otherwise we have no idea. */
     if (status == 0 && (entry->attributes & KRB5_KDB_REQUIRES_PRE_AUTH)) {
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
index 552e39a..c2f44ab 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
@@ -105,6 +105,7 @@ krb5_ldap_get_principal(krb5_context context, krb5_const_principal searchfor,
     CHECK_LDAP_HANDLE(ldap_context);
 
     if (is_principal_in_realm(ldap_context, searchfor) != 0) {
+        st = KRB5_KDB_NOENTRY;
         krb5_set_error_message (context, st, "Principal does not belong to realm");
         goto cleanup;
     }
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/lockout.c b/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
index a218dc7..fd164dd 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/lockout.c
@@ -165,6 +165,9 @@ krb5_ldap_lockout_audit(krb5_context context,
         return 0;
     }
 
+    if (entry == NULL)
+        return 0;
+
     if (!ldap_context->disable_lockout) {
         code = lookup_lockout_policy(context, entry, &max_fail,
                                      &failcnt_interval,
@@ -173,9 +176,16 @@ krb5_ldap_lockout_audit(krb5_context context,
             return code;
     }
 
-    entry->mask = 0;
+    /*
+     * Don't continue to modify the DB for an already locked account.
+     * (In most cases, status will be KRB5KDC_ERR_CLIENT_REVOKED, and
+     * this check is unneeded, but in rare cases, we can fail with an
+     * integrity error or preauth failure before a policy check.)
+     */
+    if (locked_check_p(context, stamp, max_fail, lockout_duration, entry))
+        return 0;
 
-    assert (!locked_check_p(context, stamp, max_fail, lockout_duration, entry));
+    entry->mask = 0;
 
     /* Only mark the authentication as successful if the entry
      * required preauthentication, otherwise we have no idea. */